AI in recruitment and employee assessment: what the AI Act and the GDPR require

The HR department receives hundreds of CVs in response to an advertisement, and the supplier of its recruitment software offers a module that will rank them by suitability. Another tool promises continuous assessment of the sales team’s performance based on CRM data. Both uses fall within an area that the European legislature has designated as sensitive, because the system’s output affects who gets a job and who loses one. Two sets of rules bear on the employer at once: the Artificial Intelligence Act (AI Act) and the GDPR.

When an HR tool is high-risk

The AI Act treats the systems listed in Annex III as high-risk (Article 6(2)). Point 4 of that Annex concerns employment:

AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;

— Annex III, point 4(a) to Regulation (EU) 2024/1689

Point (b) adds systems used in decisions on terms of employment, promotion and termination of employment, in allocating tasks based on behaviour or personal traits, and in monitoring and evaluating employees’ performance and behaviour. An exception to this list exists for systems that do not pose a significant risk and do not materially influence the outcome of decision-making, for example where they perform a narrow procedural or preparatory task (Article 6(3)). The exception never applies, however, where the system performs profiling of natural persons. A tool that infers an applicant’s suitability from data about them will, as a rule, be profiling.

What applies today

Following amending Regulation (EU) 2026/1744, the main obligations for high-risk systems under Annex III apply from 2 December 2027. That does not mean everything is permitted until then. Since 2 February 2025 it has been prohibited to use AI systems to infer the emotions of a natural person in the workplace, except where used for medical or safety reasons (Article 5(1)(f)). A tool that evaluates an applicant’s nervousness or enthusiasm during a video interview therefore needs to be assessed today, because it risks falling under that prohibition.

The GDPR applies in full as well. An applicant has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them (Article 22(1) of the GDPR). Automatic removal from the shortlist without anyone genuinely reviewing the outcome is a typical example. Recital 71 of the GDPR also cites e-recruiting practices without human intervention. Where the decision relies on the exception for entering into or performing a contract, or on explicit consent (Article 22(2)(a) and (c)), the controller must ensure at least the right to human intervention, the right to express a point of view and to contest the decision (Article 22(3)). Systematic and extensive evaluation of personal aspects of individuals based on automated processing, on which decisions with similarly significant effects are founded, is at the same time a case in which the GDPR expressly requires a data protection impact assessment before going live (Article 35(3)(a)).

Where performance is monitored, the Labour Code must also be borne in mind. An employer may intrude on an employee’s privacy at the workplace through monitoring only for serious reasons lying in the particular nature of its activities and after prior notice. An employer introducing a monitoring mechanism must consult employee representatives on the scope of the monitoring, the manner in which it is carried out and its duration, and must inform employees of them (Section 13(4) of Act No. 311/2001 Coll.).

The employer’s obligations from December 2027

An employer that buys a ready-made HR system is, as a rule, a deployer. If the system was placed on the market or put into service before 2 December 2027, the Regulation applies to it only if its design is subsequently subject to significant changes. Systems intended to be used by public authorities must comply by 2 August 2030 (Article 111(2) as amended). For systems to which the Regulation applies, Article 26 requires the employer in particular to:

• use the system in accordance with the provider’s instructions and adopt technical and organisational measures to that end (paragraph 1),
• assign human oversight to persons who have the necessary competence, training and authority (paragraph 2),
• where it has control over the input data, ensure that the data are relevant and sufficiently representative (paragraph 4),
• keep the logs generated by the system, where they are under its control, for at least six months (paragraph 6),
• inform employee representatives and the employees concerned before deployment in the workplace (paragraph 7),
• inform applicants and employees about whom the system helps to make decisions that a high-risk system is being used in relation to them (paragraph 11).

The employer is to use the information from the provider when carrying out the impact assessment under the GDPR (Article 26(9)). The separate fundamental rights impact assessment under Article 27 concerns public authorities, private entities providing public services and selected financial uses, not the ordinary private employer.

Where the employer assembles the tool itself

A different situation arises when an HR officer starts screening CVs through a general-purpose chatbot. A person who changes the intended purpose of a system that was not high-risk so that it becomes high-risk is deemed to be its provider, with all the attendant obligations (Article 25(1)(c)). Whether the mere use of a general-purpose tool for such a purpose is sufficient is not expressly addressed by the Regulation, but the risk should be considered. That rule too applies to systems under Annex III from 2 December 2027. How the tasks of provider and user are allocated is examined in when an AI user becomes its provider. Improvised use of a general-purpose tool to assess people may thus saddle the employer with obligations that, had it bought a finished product, its supplier would have borne.

The approach we recommend

Start by mapping where AI appears in the HR process and whether it merely assists or in fact decides about people. For each tool, ask the supplier whether it regards the tool as high-risk, and for its instructions for use. Put human review of the results in place, inform applicants and employee representatives, and carry out an impact assessment under the GDPR. Train the employees who work with the tools; what the AI literacy obligation requires following the amendment is explained in whether you must train your employees.

We prepare the classification of HR tools, human oversight rules and supplier contracts through the AI Act and deploying artificial intelligence. We align the impact assessment, information duties towards applicants and the arrangements for monitoring employees through the GDPR and personal data protection.